PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44424 shellhub-io CVE debrief

ShellHub versions prior to 0.24.2 contain an authorization bypass vulnerability in the device metadata retrieval endpoint. The GET /api/devices/:uid endpoint returns complete device objects to any authenticated caller without validating namespace (tenant) ownership. An attacker with valid credentials—whether via JWT or API key—can enumerate or guess device UIDs to exfiltrate metadata from devices belonging to other tenants. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network accessibility, low attack complexity, low privileges required, and high confidentiality impact with no integrity or availability impact. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
shellhub-io
Product
shellhub
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-05-18
Advisory published
2026-05-13
Advisory updated
2026-05-18

Who should care

Organizations operating multi-tenant ShellHub deployments; security teams managing SSH gateway infrastructure; compliance officers responsible for tenant isolation guarantees; developers maintaining ShellHub forks or custom authentication integrations.

Technical summary

The vulnerability exists in the device retrieval handler where authentication is verified but authorization is not. The :uid parameter is treated as a direct object reference without verifying that the authenticated principal's tenant matches the device's namespace. This insecure direct object reference (IDOR) pattern allows cross-tenant data access. The fix in 0.24.2 adds tenant membership validation before returning device objects.

Defensive priority

medium

Recommended defensive actions

  • Upgrade ShellHub to version 0.24.2 or later to enforce namespace-scoped authorization on device metadata endpoints.
  • Review access logs for GET /api/devices/:uid requests that returned 200 OK responses for UIDs outside the requesting user's namespace, particularly if UIDs appear sequential or guessed.
  • Implement additional monitoring for anomalous UID enumeration patterns from authenticated sessions.
  • Validate that API key and JWT authentication flows both enforce the corrected authorization logic after patching.

Evidence notes

Vendor advisory confirms the endpoint behavior and fix version. NVD record provides CVSS scoring and CPE range. No KEV entry exists.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44424 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44424

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44424 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44424

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.